The assurance-timeline disconnect in 2026 CBAM and CSRD audit engagements

Here's the issue: For third-party assurance providers, 2026 marks the convergence of multiple carbon-disclosure regimes—each with its own filing deadline, evidence standard, and fee structure. The Carbon Border Adjustment Mechanism transitions to financial liability on January 1, 2026, Corporate Sustainability Reporting Directive limited assurance begins for Wave 1 entities, and California Senate Bill 253 and 261 require first-year emissions disclosure. At first glance, the timelines appear manageable: companies have quarterly CBAM reporting windows, CSRD assurance opinions are due with annual reports, and California filings have clear cutoff dates. However, each of these compliance milestones rests on a foundation of evidence-gathering work that must be completed months earlier—and most engagement letters price the deadlines, not the preparation window.

However, the assurance engagement consists of two things: the filing deadline itself and the evidence-gathering timeline that precedes it. The filing deadline is what appears on the regulatory calendar and in board presentations. The evidence-gathering timeline is what determines when the auditor must receive population-level supporting documentation, when substantive testing begins, and when the engagement team scales up.

The filing deadline on its own has no value to the assurance provider. The evidence-gathering timeline is what the auditor is actually pricing when they quote the engagement fee. A CBAM quarterly filing due May 31, 2026 requires installation-level emissions data, utility bills, and bill-of-materials documentation to be audit-ready by mid-April to allow time for substantive testing, follow-up queries, and opinion drafting. A CSRD limited assurance opinion due with the March 31, 2027 annual report requires Scope 1, 2, and 3 evidence to be population-complete by December 2026 to allow time for sampling, variance analysis, and management representation letters. When these timelines compress—because the client delivers evidence late or because multiple regimes overlap—the engagement team must either work overtime, reduce sampling depth, or escalate the fee mid-engagement.

While filing deadlines have become more predictable, evidence-gathering windows have become shorter. The European Commission's draft Implementing Regulation on CBAM, published in May 2026, specifies that "the evidence of payment of that carbon price" must be verified by an independent person, but does not extend the quarterly filing window to accommodate the verification process^[1]. The International Auditing and Assurance Standards Board withdrew ISAE 3410 effective December 15, 2026, replacing it with ISSA 5000, which applies "regardless of how that information is presented"^[2]—meaning auditors must now verify emissions data across multiple presentation formats (CBAM filings, CSRD reports, California disclosures) within overlapping timelines. For a non-EU steel exporter filing CBAM quarterly reports, the gap between the evidence cutoff and the filing deadline might be 45 days in Q1 2026, but only 30 days in Q4 2026 once year-end CSRD assurance work begins. The marginal cost of the compressed timeline can exceed the base engagement fee.

How do you solve this? I think the most effective mitigation is to map the evidence-gathering timeline backward from each filing deadline, then flag the points where multiple regimes collide. For operators we work with, the collision typically occurs in November–December 2026 (CSRD year-end evidence cutoff) and April–May 2026 (CBAM Q1 filing plus California SB 253 emissions-year cutoff). The assurance provider who wins the engagement is the one who presents a resource-loading chart that shows when the client must deliver evidence, when substantive testing begins, and when the opinion-drafting window closes—not the one who quotes the lowest fee against the filing deadline alone. For now, the audit market is still pricing the visible deadline, not the invisible preparation window.

The shape of the argument, visualised below.

The 2026 regulatory calendar for carbon-disclosure assurance

The table below maps the major filing deadlines for CBAM, CSRD, and California SB 253/261 against the evidence-gathering timelines that precede them. Each row shows the filing deadline, the evidence cutoff (the date by which population-level documentation must be audit-ready), and the lead time available for substantive testing.

The collision points are November–December 2026 (CSRD evidence cutoff overlaps with CBAM Q3 filing) and January–February 2027 (CBAM Q4 filing overlaps with CSRD opinion drafting). Assurance providers who do not flag these collisions in the engagement letter will absorb the overtime cost or renegotiate fees mid-engagement.

What auditors are actually verifying under ISSA 5000

The withdrawal of ISAE 3410 and the adoption of ISSA 5000 effective December 15, 2026 changes the assurance landscape for greenhouse gas statements. ISAE 3410 was specific to GHG assurance engagements and provided detailed guidance on limited versus reasonable assurance procedures for emissions data^[3]. ISSA 5000, by contrast, is a general-purpose sustainability assurance standard that applies "to all types of sustainability information, including greenhouse gas emissions, regardless of how that information is presented"^[2].

This shift has two practical consequences for assurance timelines:

1. Broader evidence scope: Under ISAE 3410, the auditor's primary focus was the GHG statement itself—emissions totals, calculation methodology, and supporting documentation. Under ISSA 5000, the auditor must also consider how the emissions data connects to other sustainability disclosures (e.g., CSRD ESRS E1 climate-related metrics, California SB 253 Scope 1-3 totals, CBAM embedded emissions declarations). This means the evidence-gathering timeline must accommodate cross-regime reconciliation, not just single-regime verification.

2. Uniform assurance procedures: ISSA 5000 does not distinguish between limited and reasonable assurance at the standard level; instead, it provides a single set of requirements that scale based on the level of assurance. This removes some of the procedural shortcuts that ISAE 3410 allowed for limited assurance (e.g., inquiry and analytical procedures as primary evidence sources). The result is that limited assurance engagements under ISSA 5000 require more substantive testing than equivalent engagements under ISAE 3410, which extends the evidence-gathering window by 10–20 days in most cases.

For assurance providers, the practical question is: what counts as "sustainability information" that must be verified? The International Auditing and Assurance Standards Board's Basis for Conclusions on ISAE 3410 notes that "the types of procedures to be performed (inquiries, analytical procedures and observation and inspection)" are required to obtain "the required understanding of the entity"^[4]. Under ISSA 5000, these procedures must now be applied not only to the emissions calculation but also to the upstream data sources (invoices, utility bills, supplier declarations) and the downstream presentation formats (CBAM filings, CSRD reports, California disclosures). This is a population-level evidence requirement, and it cannot be satisfied by sampling alone.

"A limited assurance engagement undertaken in accordance with ISAE 3410 involves assessing the suitability in the circumstances of ABC's use of [applicable criteria] as the basis for the preparation of the GHG statement, assessing the risks of material misstatement of the GHG statement whether due to fraud or error, responding to the assessed risks as necessary in the circumstances, and evaluating the overall presentation of the GHG statement. A limited assurance engagement is substantially less in scope than a reasonable assurance engagement."^[5]

Under ISSA 5000, that "substantially less" qualifier is weakened. Limited assurance still requires less testing than reasonable assurance, but the baseline has shifted upward.

The cost of missed evidence deadlines

When evidence arrives after the cutoff date, the assurance provider has three options:

1. Extend the engagement timeline: This delays the opinion and may push the filing past the regulatory deadline, triggering late-filing penalties. For CBAM, late quarterly filings incur administrative fines; for CSRD, late annual report filings can delay shareholder approval.

2. Reduce sampling depth: This keeps the timeline intact but increases the risk of undetected misstatements. For limited assurance, this might be acceptable if the remaining sample still meets the "meaningful level of assurance" threshold; for reasonable assurance, it is not.

3. Absorb the overtime cost: This is the most common response, and it is almost always a loss for the assurance provider. The engagement letter specifies a fixed fee based on the original timeline; if the client delivers evidence late, the auditor either works unpaid overtime or renegotiates the fee mid-engagement (which most clients resist).

The European Commission's draft Implementing Regulation on CBAM, open for consultation until June 10, 2026, specifies that "the evidence of payment of that carbon price" must include "the qualifications of the independent person and conditions to ascertain its independence and qualifications"^[6]. This means the auditor's credentials must be documented as part of the CBAM filing itself, which adds another layer of evidence preparation. If the client delivers the carbon-price payment evidence late, the auditor cannot begin verifying the independent person's qualifications until the evidence is complete, which compresses the timeline further.

For a typical CBAM Q1 2026 filing (due May 31), if the client delivers installation-level emissions data on May 1 instead of April 15, the auditor loses 15 days of substantive testing time. Assuming the auditor bills €200/hour and the lost time amounts to 40 hours of overtime (spread across the engagement team), the marginal cost is €8,000—roughly 20–30% of a baseline quarterly CBAM assurance fee for a mid-sized exporter.

The evidence-timeline map for Q4 2026

The highest-risk period for assurance-timeline collisions is Q4 2026, when CSRD year-end evidence-gathering overlaps with CBAM Q3 filing and preparation for CBAM Q4 filing begins. The timeline below shows the critical path for a non-EU exporter filing CBAM quarterly and a Wave 1 CSRD entity preparing for limited assurance:

October 1–15, 2026: CBAM Q3 evidence cutoff. Installation-level emissions data, utility bills, and BoMs for July–September must be audit-ready by October 15 to allow 45 days for substantive testing before the November 30 filing deadline.

October 15–31, 2026: CSRD Scope 1 and 2 evidence-gathering begins. The auditor must receive utility bills, fuel invoices, and refrigerant logs for January–October to begin year-end projections and sampling planning.

November 1–30, 2026: CBAM Q3 substantive testing and CSRD Scope 3 evidence-gathering. The auditor is simultaneously verifying CBAM installation-level data and requesting Scope 3 supplier declarations for CSRD. Resource contention is high; engagement teams often split into CBAM and CSRD workstreams at this point.

December 1–31, 2026: CSRD year-end evidence cutoff. All Scope 1, 2, and 3 evidence must be population-complete by December 31 to allow 90 days for sampling, substantive testing, and opinion drafting before the March 31, 2027 annual report deadline. CBAM Q4 evidence-gathering also begins in mid-December (installation-level data for October–December).

January 1–15, 2027: CBAM Q4 evidence cutoff. Installation-level emissions data for Q4 must be audit-ready by January 15, but the CSRD engagement team is already in full substantive testing mode. If the same auditor is handling both engagements, the CBAM Q4 timeline often slips by 5–10 days.

January 15–February 28, 2027: CBAM Q4 substantive testing and CSRD opinion drafting. The auditor is verifying CBAM Q4 data while drafting the CSRD limited assurance opinion. If CBAM evidence is incomplete, the auditor cannot finalise the CBAM opinion until after the CSRD opinion is delivered, which pushes the CBAM filing to late February or early March—well past the February 28 deadline.

The timeline visualised:

Oct 1–15:   [CBAM Q3 evidence cutoff]
Oct 15–31:  [CBAM Q3 testing begins] [CSRD Scope 1/2 evidence begins]
Nov 1–30:   [CBAM Q3 testing continues] [CSRD Scope 3 evidence gathering] ← collision point
Dec 1–31:   [CSRD year-end evidence cutoff] [CBAM Q4 evidence begins] ← collision point
Jan 1–15:   [CBAM Q4 evidence cutoff] [CSRD substantive testing begins]
Jan 15–Feb: [CBAM Q4 testing] [CSRD opinion drafting] ← collision point

The three collision points (November, December, January–February) are where engagement fees escalate if the evidence timeline is not managed proactively.

How Emission3 fits

Emission3 is built for assurance timelines, not filing deadlines. The platform is document-first: every invoice, utility bill, and bill-of-materials is ingested as a source document, then transformed into line-item evidence through a deterministic LLM layer that auditors can replay. This means the evidence-gathering window collapses from months to weeks, because the client is not manually extracting data from PDFs and emails—they upload the documents, and Emission3 handles the extraction, normalisation, and lineage-linking automatically.

For a CBAM quarterly filing, the typical evidence-gathering workflow involves:

1. Collecting installation-level emissions data from plant managers (usually in Excel or PDF format).
2. Collecting utility bills and fuel invoices to verify energy consumption.
3. Collecting bills-of-materials to allocate emissions to specific product batches.
4. Extracting the relevant data points from each document (kWh consumed, fuel type, production volume).
5. Normalising the data into the CBAM reporting schema (embedded emissions per tonne of product).
6. Generating the evidence pack (source documents + calculation lineage) for the auditor.

In a manual workflow, steps 4–6 take 20–30 hours per quarter for a mid-sized exporter. In Emission3, steps 4–6 are automated: the LLM layer extracts the data points, the compliance engine normalises them into the CBAM schema, and the evidence pack is generated automatically. The time savings are 15–20 hours per quarter, which shifts the evidence cutoff from mid-April to late April for a May 31 filing—buying the auditor an extra 10–15 days of substantive testing time.

For CSRD limited assurance, the same workflow applies to Scope 1, 2, and 3 evidence. The client uploads utility bills for Scope 1 and 2, supplier declarations for Scope 3, and Emission3 generates the population-level evidence pack in hours, not weeks. The auditor receives a single artifact that includes the source documents, the calculation lineage, and the ESRS E1 disclosure outputs—ready for substantive testing on day one of the engagement.

The platform is auditor-ready: exports include evidence packs, calculation lineage, and submission-oriented outputs (CBAM XML files, CSRD XBRL tags, California SB 253 JSON). The assurance provider can replay the LLM layer's extraction logic to verify that the data points match the source documents, which satisfies the ISSA 5000 requirement to assess "the risks of material misstatement of the [sustainability information] whether due to fraud or error"^[2].

What to start this week

If you are an assurance provider pricing a CBAM, CSRD, or California SB 253/261 engagement for 2026–2027:

1. Map the evidence-gathering timeline backward from each filing deadline: Identify the evidence cutoff date (the date by which population-level documentation must be audit-ready), then calculate the lead time available for substantive testing. Flag the collision points where multiple regimes overlap.

2. Price the evidence-gathering window, not the filing deadline: The engagement fee should reflect the hours required for evidence review, substantive testing, and opinion drafting—not the hours required to meet the filing deadline. If the client delivers evidence late, the fee should include a "late evidence" premium that covers the overtime cost.

3. Specify the evidence format in the engagement letter: ISSA 5000 requires the auditor to verify sustainability information "regardless of how that information is presented"^[2]. This means the engagement letter should specify the format in which the client will deliver evidence (PDF invoices, Excel BoMs, supplier declarations), the schema the auditor will use to normalise the data (CBAM embedded emissions schema, ESRS E1 metrics, California SB 253 JSON), and the lineage documentation the auditor will review (calculation steps, data-source mappings, allocation logic). If the client delivers evidence in a different format, the engagement fee should increase to cover the additional normalisation work.

4. Flag the ISSA 5000 transition in the engagement letter: ISAE 3410 is withdrawn effective December 15, 2026, and ISSA 5000 applies to all assurance engagements on sustainability information reported for periods beginning on or after that date^[2]. For CBAM Q4 2026 filings (covering October–December 2026), ISSA 5000 applies if the engagement begins after December 15, 2026—which means the auditor must apply the broader evidence scope and uniform assurance procedures described above. The engagement letter should note this transition and the fee impact.

For non-EU exporters and Wave 1 CSRD entities, the question is: who can deliver population-level evidence in weeks, not months? The answer is the teams who treat evidence-gathering as a compliance engineering problem, not a data-entry problem. Emission3 is a call-first platform—reach out to discuss your CBAM readiness and evidence-timeline map at /contact.